CVE-2022-24124

Prefacio Casdoor es una plataforma de autenticación de inicio de sesión único SSO centralizada basada en OAuth 2.0/OIDC ID ID de CVE: CVE-2022-24124 ID CNPD: CNPD-202201-7304 Versiones afectadas Nivel de riesgo: Alto 7.5 HIGH POC/EXP: Público Casdoor POC:...

Casdoor - Authorization Bypass

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. id: CVE-2025-4210 info: name: Casdoor - Authorization Bypass author: theamanrawat severity:...

CVE-2022-24124

POC para CVE-2022-24124 Código de Exploit para CVE-2022-24124 también conocido como Casdoor SQL Injection Enlaces del Exploit: ExploitDB-50792 PacketStormSecurity Resultado esperado: Volcar la versión de la base de datos SQL en el host que ejecuta Casdoor 1.13.1 Destinado únicamente para fines...

Casdoor 1.13.0 - Unauthenticated SQL Injection

Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. id: CVE-2022-24124 info: name: Casdoor 1.13.0 - Unauthenticated SQL Injection...

csrf_casdoor

Casdoor – Cross-Site Request Forgery CSRF Resumen Vulnerabilidad: CSRF en /api/set-password que permite cambios de contraseña sin consentimiento. Versiones afectadas: Todas las versiones del software están afectadas. Actualmente no hay una versión parcheada disponible. CVE: CVE-2023-34927 la más...

CVE-2022-24124

POC para CVE-2022-24124 Código de explotación para CVE-2022-24124 también conocido como inyección SQL de Casdoor Enlaces del exploit: ExploitDB-50792 PacketStormSecurity Resultado esperado: Volcar la versión de la base de datos SQL en el host que ejecuta Casdoor 1.13.1 Diseñado únicamente para...

CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal y Escritura Arbitraria de Archivos Autenticado Este repositorio contiene una prueba de concepto PoC para el exploit CVE-2026-6815, una vulnerabilidad de escritura arbitraria de archivos y path traversal en Casdoor. La vulnerabilidad ha sido...

CVE-2026-9090-poc

CVE-2026-9090 — Bypass de firma SAML en Casdoor PoC Prueba de concepto para CVE-2026-9090 CWE-347, Verificación incorrecta de la firma criptográfica, un bypass de autenticación en la plataforma de identidad Casdoor. Atribución. CVE-2026-9090 fue publicado y coordinado por CERT/CC — ver VU780781...

CVE-2026-91998

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

CVE-2026-91998 Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

CVE-2026-91998 Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

CVE-2026-91998

Casdoor through 4.4.0 is affected by an authorization bypass in the /api/mcp endpoint that allows an attacker holding any application's clientId and clientSecret to perform unrestricted cross-organization user administration . Concretely, the attacker can enumerate user records (including passwor...

EUVD-2026-78438

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

CVE-2026-91998 Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

PT-2026-91938

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.4.1 Description An authorization bypass exists in the '/api/mcp' endpoint. Attackers possessing a valid clientId and clientSecret from any single application can gain unrestricted access to user administration acros...

CVE-2026-91998: Incorrect Authorization

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password...

CVE-2026-90942

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-90942

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in the /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. An attacker with this low-privilege access can use the exposed key to forge JWT tokens for any us...